FAQ
TL;DR: 90 % of Uascent Matter samples boot after re-encrypting with coeff 0x4862379A; "That's a great finding" [Elektroda, p.kaczmarek2, post #21465048] OpenBeken runs, but OTA still fails.
Why it matters: It turns unusable Matter switches into fully hackable Wi-Fi devices.
Quick Facts
• CPU: BK7231N / BL2028N 32-bit @ 120 MHz [Elektroda, divadiow, post #20940846]
• Factory bootloader version: 1.0.13, OTA slot starts at 0x143000 [Elektroda, divadiow, post #21231617]
• Uascent AES coeff key: 4862379A-8612784B-85C5E258-75754528 [Elektroda, divadiow, post #21465033]
• Recommended flasher: Easy Flasher v1.1 or BKFIL ≥ 0.5 [Elektroda, divadiow, post #20968329]
• Safe supply current for CB3S: ≤ 120 mA @ 3.3 V (Typical module spec).
What silicon is inside the 10 A 1-channel Matter switch?
How can I back up the factory firmware without soldering?
VCC, RX, TX and GND are reachable with probe pins; connect a USB-TTL at 3.3 V and use Easy Flasher’s “Allow backup/restore” option to read the full 2 MB flash
[Elektroda, divadiow, post #20968329]
Why does OpenBeken not boot on stock Uascent devices?
The bootloader rejects images encrypted with Tuya’s default key. Uascent devices use their own coeff key, so the checksum fails and the UART shows only two � characters
[Elektroda, divadiow, post #20940846]
What encryption key should I use?
All Uascent Matter dumps share coeff key 4862379A 8612784B 85C5E258 75754528; re-encrypting with this key plus CRC makes the 1.0.1 bootloader start
[Elektroda, divadiow, post #21465033]
How do I build a working OpenBeken image for Uascent?
- Encrypt bk7231n_bootloader.bin with the Uascent key and “-crc” using cmake_encrypt_crc.exe.
- Encrypt OpenBeken bin at offset 0x10000 with the same key.
- Run mpytools.py then BEKEN_PACK to merge; flash the resulting QIO image from 0x0 [Elektroda, p.kaczmarek2, post #21466505]
Where is the OTA partition?
Why does the AP broadcast disappear or show MAC 00:00:00:00:00:00?
If RF calibration data is missing or placed at the Tuya address 0x1D0000 instead of Uascent’s 0x1F6000, Wi-Fi starts without a valid MAC and the SSID never appears
[Elektroda, divadiow, post #21115403]
Does OTA work after flashing?
Can I simply flash a Tuya dump onto Uascent hardware?
What happens with a wrong or non-CRC bootloader?
Edge case – ESP32-C3 Matter switch with secure boot: any workaround?
Do BK7231M boards need different steps?
Is there a brick risk when experimenting?
Low. Full 2 MB backups let you restore factory state; several users re-flashed successfully after bad tests
[Elektroda, divadiow, post #20940609] A true brick occurs only if eFuse security bits are altered, which the flasher cannot do.
Where can I download ready-made images?
Which tools are most reliable for flashing and restore?
Generated by the language model.
Comments
That's a very interesting and informative post. I haven't seen a matter BK7231 yet. Are you really sure that's BK7231N inside and not a BK7231M? Since you're saying it's not booting, did you try... [Read more]
interesting. I had not heard of BK7231M. After spending ages flashing various CB3S and other BK7231N firmware, and even the BK7231M firmware from https://www.elektroda.com/rtvforum/viewtopic.php?p=20837165#20837165 I... [Read more]
That's very strange, BL2028N is known to work with OpenBeken. Have you tried flashing whole 2MB of dump from a working OBK device or a flashable Tuya device? I would say that it has to work, because... [Read more]
yeh weird. I'll flash again with OBK and leave it longer. [Read more]
I've searched for 0x00401C1C , here is a possibly related thread: Flashing Aubess Plug via Serial Adapter: BK7231M/CB2S Not Creating Open AP Post-Flash That seem to confirm that you have the M flavour... [Read more]
yes, quite a few now. some of my own and at least these two in repo. no AP or log out with any https://obrazki.elektroda.pl/3295173900_1706896095_thumb.jpg do we have any full 2mb ones from... [Read more]
I have some BK7231M devices sent by a user. Currently I've checked the dumps and they seem to have changed encryption keys, so the solution would be to build OBK with a correct keys: https://obraz... [Read more]
to add the public discourse the shield over the Belon has these markings - UAM028 https://obrazki.elektroda.pl/7019581100_1706947096_thumb.jpg which suggests these are not Tuya, but uHome.... [Read more]
What is the MAC address of this device? Added after 24 : EDIT: Wait it seems you posted the reply on the screenshot while I was posting my question [Read more]
ha. thought you'd gone mad 38:73:EA:E2:C5:8B yes [Read more]
I picked up another Matter device. The familiar 16A mini switch. To my surprise this one comes with an ESP32-C3 chip on module SM-028C3 on a little riser. I can only find this in relation to that module... [Read more]
Hi @divadiow How did you restore to the stock firmware for the BL chip? [Read more]
oh. I think I used the Easy flasher. You have to check the "allow backup restore" box https://obrazki.elektroda.pl/8944725900_1708330279_thumb.jpg and I think the filename has to start "readResult_BK7231N_QIO.."... [Read more]
Thanks, i actually tried to restore to stock using bk7231tools but never worked for me. This was before easy launcher tool though Do you plan to swap esp32c3 chip on the matter relay switch since it’s... [Read more]
excellent. well. I don't *need* to, I have it just to play with tbh. I've got quite a few smart switches now. I am playing with a tiny ESP8285 that was orphaned from a destroyed GU10 that I've... [Read more]
Any WB2S/CB2S should be a drop in replacement Or this esp32c2 module https://m.intl.taobao.com/detail/detail.html?id=717948565081 [Read more]
sure. a module would be much nicer than squeezing in something hacky. though it'd be more about the challenge than ending up with a working/deployable device. [Read more]
Not quite, but I do have a similar relay device like the matter version you have but it’s using TR6260 chip. I swapped it for esp32c2 running tasmota [Read more]
ah yes. i see https://www.elektroda.com/rtvforum/topic3965929.html [Read more]